By KYN AI Advisory Team — AI implementation specialists, Singapore
To find business emails legally in Singapore, use addresses the business itself publishes for business purposes, such as a contact page, a registry filing or a signature on a message the person sent you. Record where each address came from. Then check the rules that apply before you send: the Personal Data Protection Act (PDPA), the Spam Control Act and, for phone-based channels, the Do Not Call Registry. Guessing addresses from name patterns is the step to avoid.
This is a practical guide, not legal advice. Rules change. Read the linked sources, and take advice from a lawyer for your own case.
What does the law cover?
Three regimes matter for outbound B2B messages in Singapore. They overlap but do not cover the same things.
| Regime | Covers | Why it matters for email finding | |---|---|---| | PDPA | Collection, use and disclosure of personal data | An email address tied to a named person is personal data in many contexts | | Spam Control Act 2007 | Unsolicited commercial electronic messages | Sets requirements such as an unsubscribe facility | | Do Not Call provisions | Marketing messages to Singapore telephone numbers, including by SMS and WhatsApp | Applies when your finding step produces a mobile number |
The PDPA treats business contact information differently from other personal data. The exact scope, and what counts as business contact information, is set in the Act and in PDPC guidance. Read the current wording rather than relying on a summary, including this one.
Which sources are safe?
Rank sources by how clearly the business meant the address to be used for business contact.
- The company's own contact page. A general address such as sales@ or info@ is published for exactly this. Safest.
- A named business address on the company site. A team page that lists a person's work email is a deliberate publication.
- The contact's own message. If a person emailed you, their address is yours to reply to, within the purpose of that exchange.
- A business card or a form they filled in. Record the context, such as the event and date.
- Registry filings. Some filings list a company contact address. Use these for company-level contact only.
- Trade association or chamber directories. Check the directory's terms. Many bar bulk use.
- A data vendor. Acceptable if the vendor documents where it got the data and you can verify that. See how to test a data vendor on 100 records.
For each address, store the source URL, the date you read it and the purpose of publication. That record is your evidence if anyone asks where an address came from.
Which methods should you avoid?
- Guessing patterns. Trying firstname.lastname@company.com and keeping the ones that do not bounce is guesswork on an individual's data. Hard bounces from guesses also damage your sending reputation.
- Scraping behind a login. Collecting contact details from a platform that requires sign-in usually breaches its terms.
- Buying an unsourced list. If the seller cannot say where the data came from, you cannot say either.
- Harvesting from personal or social profiles. A public profile is not consent to marketing mail.
- Repurposing. An address given for a support ticket was not given for marketing.
How do you check an address is real without guessing?
Verification checks the address, not the person. It is a different step from finding.
- Check the domain has working mail records.
- Use a verification service that tests the mailbox without sending, if its terms allow this for your case.
- Send only to addresses with a source on record.
If you cannot source it, leave it out. A shorter list that you can defend beats a longer one you cannot.
What must every message include?
Before the first send, build these into the template, not into a checklist.
- A clear sender identity: your name, company and a way to contact you.
- An unsubscribe route that works. For mailbox providers, Google's email sender guidelines require one-click unsubscribe for marketing and subscribed messages from senders above 5,000 messages a day, and it is a sound default below that.
- A suppression list checked before every send, across every channel.
- A statement of why you are writing, tied to the recipient's business role.
See out-of-office, bounces and unsubscribes: agent rules for how an agent should treat unsubscribe replies. If your agent sends, a named person should approve new outbound messages; see is it safe to let an AI agent send emails to customers.
What about Hong Kong, Indonesia and Malaysia?
The rules differ by country, and they follow the recipient. A Singapore company mailing a Hong Kong business is subject to Hong Kong's rules for that message. Each market has a privacy regime and a rule for commercial electronic messages. Check the regulator for the recipient's country before you build a list there: the PCPD in Hong Kong, the Indonesian data protection law and its regulator, and the JPDP in Malaysia.
How should an agent handle this?
An agent that finds contacts needs the same discipline as a person, written as rules.
- Allowed sources only. The agent reads a defined list of sources. It does not try patterns.
- Source on every record. No source URL, no record.
- Role over person where possible. A role address or a role title is enough for most B2B outreach.
- Suppression first. Check the list before the record can enter a campaign.
- Review. A person approves the list and the first message of each campaign.
These rules cost little to build and remove most of the legal and deliverability risk.
What does a source log look like?
A source log is a table your team or agent fills for every address. It takes under a minute per record and answers most questions later.
| Field | Example (illustrative) | |---|---| | Address | enquiries@examplefirm.sg | | Type | Role address | | Source URL | The company's contact page | | Date read | 30 October 2026 | | Purpose of publication | General business enquiries | | Channel allowed | Email | | Suppression status | Not suppressed | | Added by | Agent account, approved by a named person |
Three edge cases come up often.
- A named address on a conference page. It was published for attendees, not for sales. Treat it as a weak source and write to the role instead.
- A forwarded introduction. The introducer gave you a route, not a list entry. Reply to the thread; do not add the person to a campaign.
- An address that stops working. Delete the record when it hard bounces. Do not try variants.
Review the log quarterly. Delete rows older than your retention rule, and remove any row whose source page no longer shows the address.
Where KYN fits
KYN builds outreach agents that run in the client's own cloud account. For an insurance brokerage, each outreach email carries one checkable first line taken from a cited source, at about S$0.02 per email. The suppression list is checked before every send, every action is logged with the actor, and outbound messages wait for a named person.
The first 14 days go on reviewing where your current contact data came from and interviewing whoever sends the outreach. A full build ships in under 90 days. See sales systems and security.
Frequently asked questions
Can I email a business address I found on a company website?
Often yes for a general business address published for contact, subject to the Spam Control Act's requirements and your purpose. Record the source, include an unsubscribe route, and write about the recipient's business role. Take legal advice for your own case.
Is it legal to guess an email address?
The legal position depends on the facts, and the practical risk is clear. Guessed addresses can reach the wrong person, produce bounces and damage your domain reputation. Use sourced addresses.
Do I need consent to send a B2B cold email in Singapore?
The rules depend on the channel and content. Email is governed by the Spam Control Act, and phone-number channels by the Do Not Call provisions. Read both sources above, and check which applies to your message.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
